# Wrong accounting of the storage balances results for the protocol to be in debt even when the bad debt is repaid.

Unstoppable Vault double-counts bad debt: not subtracted from total_debt_amount, so repaid bad debt still blocks LP withdrawals.

- Payout: Contest reward
- Severity: high
- Program: Unstoppable
- Credited: Yuki
- Disclosed: 2023-06-21
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-06-unstoppable-judging/issues/68
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-06-unstoppable%3AH-1
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Vyper margin-dex Vault contract (_close_position / _available_liquidity)
**Root cause:** On bad debt, _close_position adds to bad_debt but never reduces total_debt_amount, so the same amount is subtracted twice in _available_liquidity and persists even after repay_bad_debt.
**Steps:**
1. Open a leveraged position via margin-dex.
2. Price moves against trader; close position so amount_out_received < position_debt_amount.
3. Observe bad_debt[token] += (debt - received) but total_debt_amount unchanged.
4. Call repay_bad_debt(token, amount) — bad_debt decreases, total_debt_amount still holds the amount.
5. LP calls withdraw_liquidity; _available_liquidity = total_liquidity - total_debt_amount is short by the bad debt, blocking full withdrawal.
**How found:** Code reading of _close_position bad-debt branch versus _update_debt/_available_liquidity accounting; noticed bad debt added to bad_debt but not removed from total_debt_amount, then traced double subtraction in _total_liquidity and _available_liquidity.
**Exploitation:** No attacker profit path; bad debt arises naturally from an underwater position close. The stale total_debt_amount keeps accruing interest and permanently reduces available liquidity, locking LP funds.
**Insight:** In lending/margin protocols, when writing off bad debt, check every aggregate counter (total_debt, total_liquidity, interest bases) is decremented in the same branch — a write-off that only touches one mapping double-counts the loss and silently freezes LP withdrawals.